# DF-1434 — Verification Verdict

## Verdict: CONFIRMED-BY-SOURCE-TRACE (operator-only, maxx not in operator)

**Status:** inconclusive (HW-gated / not reachable as unprivileged maxx)
**Impact:** none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only)
**Confidence:** certain (source-trace confirmed bug is real)

## Mechanism

acd_ioctl CDRIOCSETBLOCKSIZE (:723-726): cdp->block_size=*(int*)data, no validation. acd_set_ioparm (:951): rounddown(iomax,block_size) = (iomax/block_size)*block_size. block_size=0 → div-by-zero #DE panic. No caps_priv_check (unlike CDIOCRESET at :360 which has one). /dev/acdN is 0640 root:operator.

**Source:** `sys/dev/disk/nata/atapi-cd.c:723-726, 951`

## Why it cannot be reproduced on this guest

Operator-group only. /dev/acd0 is 0640 root:operator. maxx (uid 1001) is NOT in operator group. Cannot open the device.

## Phase 6: Escalation Assessment

This is a **Operator-only (NATA ATAPI CD)** finding. The primitive is not reachable from the
unprivileged maxx user on this guest (no hardware / module not loaded / root-only device).
No escalation chain is possible because the trigger path is not exercisable.

For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not
present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest.
For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx
(uid 1001) has no operator group membership.

## Fix

Reject block_size <= 0 in CDRIOCSETBLOCKSIZE handler with EINVAL.

**Fix description:** Add `if (*(int*)ap->a_data <= 0) { error = EINVAL; break; }` guard in CDRIOCSETBLOCKSIZE.

The full git-apply-able diff is in `fix.diff`. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via `make nativekernel` rc=0).

## Classification

- **status:** inconclusive
- **reproduced:** 0
- **impact:** none
- **fix_status:** not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)